Ransomware Group Claims Attacks on South Korea’s Hyundai E&C and Daeah E&C

A ransomware group called Metaencryptor claims it has hit Hyundai E&C, the construction arm of South Korea’s Hyundai group. The group also lists Daeah E&C, a Korean power-plant builder, on its leak site. It says it took 100 GB of data from that company.

None of the listed firms has confirmed an attack. The claims come only from the leak site of the group, and no independent party has verified them.

What the Leak Site Shows

MetaEncryptor posted Hyundai E&C on its leak site on November 7, 2026. The listing includes the name, sector, and country of the victim. It does not provide file counts or ransom demands. Further, the criminal group attached the public domain of the company to the claim.

The group also posted Daeah E&C on the same day. That listing does include a data size of 100 GB. It also shows a revenue figure of USD 491 million for the company. Two other Korean firms appear alongside them. These are Wooshin Systems and Daewon Chemical. At the time of capture, those two listings showed zero publicly released files.

The information on the leak website does not include samples from any of the four companies. This lack of evidence makes it difficult to determine whether the criminal organization possesses real data. In most situations, hackers release a limited number of files to show that they really have access. Metaencryptor has not done so in these cases.

Why the Claims Raise Questions

The listing of Hyundai E&C includes a detail that undermines its credibility too. The description of the claim refers to the entire Hyundai Motor Group and not to the construction branch only. It mentions cars, steel, & about 250,000 employees. Such data points to the entire group rather than only Hyundai E&C.

The Korean media noted this mismatch. Industry observers said the error lowers the credibility of the claim. They also pointed out that none of the four companies has confirmed an attack.

The track record of the group adds to the doubt. MetaEncryptor has published 9 claims in the last 30 days. Ransomware groups usually put the names of victims on their sites once the negotiations hiccup. The name on the list means that the data was obtained, but does not constitute the proof that the group has hacked the company.

The group itself is relatively new, as researchers first registered it in 2025. It is a ransomware-as-a-service organization, which means that it provides tools for affiliate companies to carry out attacks. The core team takes a share of each payment. This model lets the group claim many victims without doing all the work itself.

The Listed Companies 

Hyundai E&C is among the top construction companies in South Korea. The firm undertakes the construction of projects like roads, factories, and commercial buildings, both domestically and overseas. Any breach here would lead to the compromise of secrets relating to project plans, suppliers, and employees.

Daeah E&C specializes in power plant construction. Its work ties it to utilities and government contracts. Stolen data from this sector can reveal grid details and supplier networks.

Wooshin Systems makes automotive parts and factory equipment. Daewon Chemical produces industrial chemicals. Both firms supply larger manufacturers. A leak at either company could ripple into the supply chains they serve.

None of the four companies has issued a public statement. They have also not reported the matter to regulators. Korean law requires firms to notify authorities when personal data is exposed. That process has not started, according to public records.

What Defenders Should Watch

According to security specialists, a leak site listing should be deemed as an allegation rather than a confirmed breach. They suggest companies should verify the announcement of the business before taking measures against the leak.

South Korean companies have faced other AI-driven cyber threats as well. In a separate case, last month, police said a South Korean hacker used AI to breach 60 companies in just 40 days, highlighting the growing risks businesses face from increasingly automated attacks.

For manufacturing corporations, such a statement constitutes a sign of warning. The group appears to have a penchant for hacking corporate web assets. Exposed obsolete software, vulnerable access points, and weak login information gives them the chance to perform hacking. Therefore, the IT staff should check backups and confirm that they can return to normal operations without any paying ransoms.

It is advisable to treat any email mentioning these companies with great caution. Often, leaked information supports phishing attempts shortly after the incident. It is necessary for employees to update their passwords for their email and enable two-step verification.

The firms must investigate who they allow to access their data storage systems. Limiting access to only those employees who need it minimizes the chances of a successful hack.